From: Arthur Bied-Charreton <a.bied-charreton@proxmox.com>
To: pve-devel@lists.proxmox.com
Subject: [PATCH pve-firewall v4 01/27] firewall: move object reference helpers to their own module
Date: Thu, 22 Oct 2026 14:46:42 +0200 [thread overview]
Message-ID: <20261022124708.429069-2-a.bied-charreton@proxmox.com> (raw)
In-Reply-To: <20261022124708.429069-1-a.bied-charreton@proxmox.com>
The following commits add a lot of functionality related to handling
references to firewall objects in the different configuration files.
Create a new PVE::Firewall::References module grouping this
functionality instead of accumulating it in the generic Helpers module,
and move collect_refs() there.
No functional changes intended.
Signed-off-by: Arthur Bied-Charreton <a.bied-charreton@proxmox.com>
---
src/PVE/API2/Firewall/Cluster.pm | 6 ++--
src/PVE/API2/Firewall/VM.pm | 7 +++--
src/PVE/Firewall/Helpers.pm | 38 -------------------------
src/PVE/Firewall/Makefile | 2 +-
src/PVE/Firewall/References.pm | 48 ++++++++++++++++++++++++++++++++
5 files changed, 57 insertions(+), 44 deletions(-)
create mode 100644 src/PVE/Firewall/References.pm
diff --git a/src/PVE/API2/Firewall/Cluster.pm b/src/PVE/API2/Firewall/Cluster.pm
index ebd955d..62f596d 100644
--- a/src/PVE/API2/Firewall/Cluster.pm
+++ b/src/PVE/API2/Firewall/Cluster.pm
@@ -6,6 +6,7 @@ use PVE::Exception qw(raise raise_param_exc raise_perm_exc);
use PVE::JSONSchema qw(get_standard_option);
use PVE::Firewall;
+use PVE::Firewall::References;
use PVE::API2::Firewall::Aliases;
use PVE::API2::Firewall::Rules;
use PVE::API2::Firewall::Groups;
@@ -273,8 +274,9 @@ __PACKAGE__->register_method({
my $allowed_vnets = PVE::API2::Firewall::Helpers::get_allowed_vnets();
my $sdn_conf = PVE::Firewall::load_sdn_conf($allowed_vms, $allowed_vnets);
- my $cluster_refs = PVE::Firewall::Helpers::collect_refs($conf, $param->{type}, "dc");
- my $sdn_refs = PVE::Firewall::Helpers::collect_refs($sdn_conf, $param->{type}, "sdn");
+ my $cluster_refs = PVE::Firewall::References::collect_refs($conf, $param->{type}, "dc");
+ my $sdn_refs =
+ PVE::Firewall::References::collect_refs($sdn_conf, $param->{type}, "sdn");
return [@$sdn_refs, @$cluster_refs];
},
diff --git a/src/PVE/API2/Firewall/VM.pm b/src/PVE/API2/Firewall/VM.pm
index c3a5acc..0c556b9 100644
--- a/src/PVE/API2/Firewall/VM.pm
+++ b/src/PVE/API2/Firewall/VM.pm
@@ -7,6 +7,7 @@ use PVE::Exception qw(raise_param_exc);
use PVE::JSONSchema qw(get_standard_option);
use PVE::Cluster;
use PVE::Firewall;
+use PVE::Firewall::References;
use PVE::API2::Firewall::Rules;
use PVE::API2::Firewall::Helpers;
use PVE::API2::Firewall::Aliases;
@@ -300,11 +301,11 @@ sub register_handlers {
my $sdn_conf = PVE::Firewall::load_sdn_conf($allowed_vms, $allowed_vnets);
my $dc_refs =
- PVE::Firewall::Helpers::collect_refs($cluster_conf, $param->{type}, 'dc');
+ PVE::Firewall::References::collect_refs($cluster_conf, $param->{type}, 'dc');
my $sdn_refs =
- PVE::Firewall::Helpers::collect_refs($sdn_conf, $param->{type}, "sdn");
+ PVE::Firewall::References::collect_refs($sdn_conf, $param->{type}, "sdn");
my $vm_refs =
- PVE::Firewall::Helpers::collect_refs($fw_conf, $param->{type}, 'guest');
+ PVE::Firewall::References::collect_refs($fw_conf, $param->{type}, 'guest');
return [@$dc_refs, @$sdn_refs, @$vm_refs];
},
diff --git a/src/PVE/Firewall/Helpers.pm b/src/PVE/Firewall/Helpers.pm
index fa3646c..eb8b58a 100644
--- a/src/PVE/Firewall/Helpers.pm
+++ b/src/PVE/Firewall/Helpers.pm
@@ -16,7 +16,6 @@ our @EXPORT_OK = qw(
lock_vmfw_conf
remove_vmfw_conf
clone_vmfw_conf
- collect_refs
flush_fw_ct_entries_by_mark
);
@@ -153,43 +152,6 @@ sub dump_fw_logfile {
return ($state{'count'}, $state{'lines'});
}
-sub collect_refs {
- my ($conf, $type, $scope) = @_;
-
- my $res = [];
-
- if (!$type || $type eq 'ipset') {
- foreach my $name (keys %{ $conf->{ipset} }) {
- my $data = {
- type => 'ipset',
- name => $name,
- ref => "+$name",
- scope => $scope,
- };
- if (my $comment = $conf->{ipset_comments}->{$name}) {
- $data->{comment} = $comment;
- }
- push @$res, $data;
- }
- }
-
- if (!$type || $type eq 'alias') {
- foreach my $name (keys %{ $conf->{aliases} }) {
- my $e = $conf->{aliases}->{$name};
- my $data = {
- type => 'alias',
- name => $name,
- ref => $name,
- scope => $scope,
- };
- $data->{comment} = $e->{comment} if $e->{comment};
- push @$res, $data;
- }
- }
-
- return $res;
-}
-
# This is checked in proxmox-firewall to avoid log-spam due to failing to parse the config
our $FORCE_NFT_DISABLE_FLAG_FILE = "/run/proxmox-nftables-firewall-force-disable";
diff --git a/src/PVE/Firewall/Makefile b/src/PVE/Firewall/Makefile
index 3274bc6..6c1dae4 100644
--- a/src/PVE/Firewall/Makefile
+++ b/src/PVE/Firewall/Makefile
@@ -2,7 +2,7 @@ DESTDIR=
PREFIX=/usr
PERLDIR=$(DESTDIR)/$(PREFIX)/share/perl5
-SOURCES=Helpers.pm
+SOURCES=Helpers.pm References.pm
.PHONY: install
install: $(SOURCES)
diff --git a/src/PVE/Firewall/References.pm b/src/PVE/Firewall/References.pm
new file mode 100644
index 0000000..a4ea967
--- /dev/null
+++ b/src/PVE/Firewall/References.pm
@@ -0,0 +1,48 @@
+package PVE::Firewall::References;
+
+use strict;
+use warnings;
+
+use base 'Exporter';
+our @EXPORT_OK = qw(
+ collect_refs
+);
+
+sub collect_refs {
+ my ($conf, $type, $scope) = @_;
+
+ my $res = [];
+
+ if (!$type || $type eq 'ipset') {
+ foreach my $name (keys %{ $conf->{ipset} }) {
+ my $data = {
+ type => 'ipset',
+ name => $name,
+ ref => "+$name",
+ scope => $scope,
+ };
+ if (my $comment = $conf->{ipset_comments}->{$name}) {
+ $data->{comment} = $comment;
+ }
+ push @$res, $data;
+ }
+ }
+
+ if (!$type || $type eq 'alias') {
+ foreach my $name (keys %{ $conf->{aliases} }) {
+ my $e = $conf->{aliases}->{$name};
+ my $data = {
+ type => 'alias',
+ name => $name,
+ ref => $name,
+ scope => $scope,
+ };
+ $data->{comment} = $e->{comment} if $e->{comment};
+ push @$res, $data;
+ }
+ }
+
+ return $res;
+}
+
+1;
--
2.47.3
next prev parent reply other threads:[~2026-10-22 12:47 UTC|newest]
Thread overview: 28+ messages / expand[flat|nested] mbox.gz Atom feed top
2026-10-22 12:46 [PATCH container/docs/firewall/manager/network/qemu-server v4 00/27] handle dangling references when firewall objects go away Arthur Bied-Charreton
2026-10-22 12:46 ` Arthur Bied-Charreton [this message]
2026-10-22 12:46 ` [PATCH pve-firewall v4 02/27] firewall: references: add helpers to update object references Arthur Bied-Charreton
2026-10-22 12:46 ` [PATCH pve-firewall v4 03/27] firewall: references: log the references an object update touched Arthur Bied-Charreton
2026-10-22 12:46 ` [PATCH pve-firewall v4 04/27] firewall: references: add wrappers for the SDN-generated IPSets Arthur Bied-Charreton
2026-10-22 12:46 ` [PATCH pve-firewall v4 05/27] firewall: parser: do not log errors for disabled rules Arthur Bied-Charreton
2026-10-22 12:46 ` [PATCH pve-firewall v4 06/27] firewall: ipset: add option to handle dangling references on rename Arthur Bied-Charreton
2026-10-22 12:46 ` [PATCH pve-firewall v4 07/27] firewall: ipset: add option to handle dangling references on delete Arthur Bied-Charreton
2026-10-22 12:46 ` [PATCH pve-firewall v4 08/27] firewall: aliases: add option to handle dangling references on rename Arthur Bied-Charreton
2026-10-22 12:46 ` [PATCH pve-firewall v4 09/27] firewall: aliases: add option to handle dangling references on delete Arthur Bied-Charreton
2026-10-22 12:46 ` [PATCH pve-firewall v4 10/27] firewall: api: run reference updates as tasks Arthur Bied-Charreton
2026-10-22 12:46 ` [PATCH pve-firewall v4 11/27] firewall: tests: add tests for object reference updates Arthur Bied-Charreton
2026-10-22 12:46 ` [PATCH pve-firewall v4 12/27] firewall: references: handle security groups Arthur Bied-Charreton
2026-10-22 12:46 ` [PATCH pve-firewall v4 13/27] firewall: groups: add option to handle dangling references on rename Arthur Bied-Charreton
2026-10-22 12:46 ` [PATCH pve-firewall v4 14/27] fix #8176: firewall: groups: handle dangling references on delete Arthur Bied-Charreton
2026-10-22 12:46 ` [PATCH pve-network v4 15/27] apply: add option to handle dangling references on VNet deletion Arthur Bied-Charreton
2026-10-22 12:46 ` [PATCH qemu-server v4 16/27] api: destroy_vm: add option to handle dangling IPSet references Arthur Bied-Charreton
2026-10-22 12:46 ` [PATCH pve-container v4 17/27] " Arthur Bied-Charreton
2026-10-22 12:46 ` [PATCH pve-docs v4 18/27] firewall: remove trailing spaces Arthur Bied-Charreton
2026-10-22 12:47 ` [PATCH pve-docs v4 19/27] firewall: document renaming and removing objects Arthur Bied-Charreton
2026-10-22 12:47 ` [PATCH pve-manager v4 20/27] ui: firewall: add a common widget for handling dangling references Arthur Bied-Charreton
2026-10-22 12:47 ` [PATCH pve-manager v4 21/27] ui: firewall: ipset: add controls for " Arthur Bied-Charreton
2026-10-22 12:47 ` [PATCH pve-manager v4 22/27] ui: firewall: aliases: " Arthur Bied-Charreton
2026-10-22 12:47 ` [PATCH pve-manager v4 23/27] ui: sdn: apply: add control for dangling IPSet references Arthur Bied-Charreton
2026-10-22 12:47 ` [PATCH pve-manager v4 24/27] ui: guest destroy: use let for non-constant variable bindings Arthur Bied-Charreton
2026-10-22 12:47 ` [PATCH pve-manager v4 25/27] ui: guest destroy: add control for dangling IPSet references Arthur Bied-Charreton
2026-10-22 12:47 ` [PATCH pve-manager v4 26/27] ui: firewall: show the task for reference updates Arthur Bied-Charreton
2026-10-22 12:47 ` [PATCH pve-manager v4 27/27] ui: firewall: groups: add controls for dangling references Arthur Bied-Charreton
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20261022124708.429069-2-a.bied-charreton@proxmox.com \
--to=a.bied-charreton@proxmox.com \
--cc=pve-devel@lists.proxmox.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.